GitHub Advisoryadvisory · Packagist
GHSA-2rwh-262r-r85j Dolibarr ERP and CRM malicious executable loading
HIGH
Official page ↗
- Aliases
- CVE-2019-11200
- Ecosystem
- Packagist
- Packages
- dolibarr/dolibarr
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Reviewed
- 2023-07-14
Affected packages
• Packagist dolibarr/dolibarr: < 9.0.3 → fixed in 9.0.3
Description
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
Related
Alias · CVE (1)
- CVE-2019-11200 Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-11200 advisory
- https://github.com/Dolibarr/dolibarr/issues/10984#issuecomment-488297419 web
- https://github.com/Dolibarr/dolibarr/commit/01075081cbcd9130a72115cdb50ee61fc394edc1 web
- https://github.com/Dolibarr/dolibarr/commit/d6ae62478c8841fdfe58971494818b599f396d4f web
- https://github.com/Dolibarr/dolibarr package
- https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities web